AI Engineer Europe 2026
Cognitive Exhaust Fumes, or: Read-Only AI Is Underrated — Šimon Podhajský, Head of AI, Waypoint
Read the talk
Cognitive Exhaust Fumes: Building a Read-Only Personal AI
A personal AI can connect your reading, commitments, and relationships without acting for you. The useful boundary separates observation from action, but it does not eliminate privacy risk.
From a talk by Šimon Podhajský
What can an AI learn without acting for you?
What would a personal AI be useful for if it knew you but could not send a message, change a task, or act on your behalf? Šimon Podhajský starts with that constraint: six data sources, read access only, and no permissions to write back. The restriction is intentional, not an unfinished step toward automation.
He calls the raw material cognitive exhaust fumes: digital activity left behind as a byproduct of thinking. A single trace may look disposable. Taken together, those traces can reveal patterns in the activity that produced them, much as analyzing exhaust can help diagnose an engine.
The useful patterns cross application boundaries:
- Intention-action gaps: differences between what you intend to do and what your activity shows.
- Attention drift: changes in what captures your attention.
- Relationship decay: connections that receive less attention over time.
Your email client does not know what you journaled; your task manager does not know what you browsed. The cross-source signal is the product.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Separate sources, analysis, and outputs
Read-only does not mean the system cannot create a file. It means the AI cannot modify the sources it observes. Podhajský separates the system into three zones:
| Zone | Purpose | Write boundary |
|---|---|---|
| Sources | Supply personal activity | No AI writes back |
| Workspace | Analyze the collected material | Analysis happens here |
| Outputs | Hold results for human review | Separate from the sources |
His outputs land in a separate Obsidian vault. A separate Notion destination or ordinary text files would serve the same purpose: analysis becomes something to review without rewriting the underlying record.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Turn a week of activity into reflection
The first application is a weekly reflection inspired by David Allen’s Getting Things Done Weekly Review. Instead of asking the user to reconstruct the week from memory, the system synthesizes material from all six sources. The result can be an occasionally brutal account of how the week was spent.
The workflow runs through Claude, with the logic packaged as a slash command or skill:
- Invoke the weekly reflection skill.
- Launch a Python script that gathers data from the read-only sources.
- Apply prepared prompts and call the Anthropic API for structured outputs.
- Turn those outputs into a Markdown document for review.
The separation between structured analysis and document rendering makes the final artifact straightforward to inspect. A small Python renderer illustrates that last step, taking already-produced analysis and writing only to a separate output directory:
python
from pathlib import Path
def write_reflection(sections: dict[str, list[str]], output_dir: Path) -> Path:
output_dir.mkdir(parents=True, exist_ok=True)
document = ["# Weekly reflection"]
for heading, items in sections.items():
document.append(f"## {heading}")
document.append("\n".join(f"- {item}" for item in items))
destination = output_dir / "weekly-reflection.md"
destination.write_text("\n\n".join(document) + "\n", encoding="utf-8")
return destination
This output convention expresses the architecture; source permissions must enforce the read-only boundary separately.
When the run finishes, Podhajský opens the Markdown in Cursor and switches to a readable preview. It identifies themes of the week, tensions and conflicts, commitments and relationships, notable moments, and questions for reflection. The relationship and commitment sections are revealing partly through omissions: what did not receive attention can matter as much as what did. The aim is to reflect on how he is thinking, rather than produce a productivity score.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Find someone to discuss your reading with
The next question is more specific: given what I have been reading, who in my network should I discuss it with? Podhajský enjoys sharing reading with others but wants to look beyond the same three habitual recipients. This example combines four sources that were not designed to work together. Its output is a suggestion: nothing is sent and nothing is scheduled.
A plain-language request activates the cross-source query skill. It works through curated databases that receive regular ingestion, including a Vivaldi SQLite database used to examine reading activity. The query identifies articles he has read frequently and articles still open in tabs, then looks for people whose profiles suggest an interest in those topics.
Clay MCP supplies the relationship search. Podhajský describes Clay as his CRM—or, more personally, his friend relationship system. In this run, Claude searches for contacts interested in AI, European tech, and education. He calls this the weakest part of the workflow because the Clay searches are slow. The read-only constraint belongs to his system’s configuration; it should not be inferred merely from the connector’s name.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
From large search responses to specific recommendations
The search results consume substantial context. Podhajský recommends starting with a clean session and clearing it afterward; he refers to a one-million-token context window for “4.6.” That is a capacity reference, not measured token usage or retrieval accuracy. Both Claude Opus 4.6 and Claude Sonnet 4.6 were announced with that capacity, so the shorthand does not identify the demo’s exact variant or enabled limit.
Once the Clay responses arrive, Claude synthesizes the candidate contacts and maps each person to one article. As the demonstration continues, that mapping is still being assembled with shell commands in Claude Code. Podhajský mentions auto mode and --dangerously-skip-permissions as ways to reduce permission friction. They have different protections: auto mode makes permission decisions with safeguards, while the flag bypasses permission checks. Neither establishes the source-access boundary.
The finished recommendations look useful to him: people he might want to approach, whom he has not yet talked to about these readings. The result even finds an article’s author already in his network. In the displayed table, Jiří Dolejš appears with the rationale “He wrote it,” alongside contact, rationale, and opener columns. The proposed conversation remains for Podhajský to initiate.
The browser alone could identify reading activity but would lack the contacts. The CRM could find people but would lack the reading context. Joining those records produces a person-to-article recommendation that neither source can supply on its own.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Keep action—and the feedback loop—with the user
Why stop at a recommendation when the system could send the message? Podhajský’s answer begins with asymmetric consequences. He calls the downside of an incorrect read-only suggestion zero when he can simply ignore it. An incorrect write can instead affect a relationship, a career, or a reputation. That comparison concerns the consequences of acting on someone’s behalf; it does not establish that reading private data is risk-free. He would rather forgo automated emails than accept a consequential misfire.
The second reason concerns the quality of the evidence. If AI starts writing into the same systems it analyzes, future observations mix human activity with AI-generated activity. A pattern in the record becomes harder to attribute: is this how the person thinks, or how the automation behaves? Keeping sources untouched preserves a clearer record of the activity being observed.
An observer still changes behavior. Reading a reflection may prompt a different decision next week. But the loop runs through the person: read, decide, then act. It does not automatically close through an AI rewrite. Podhajský extends this into a preference for reclaiming personal agency, even in drafting—while acknowledging that this preference may be a hard sell to an audience building AI tools.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
An observer serves a different need
Podhajský has also tried OpenClaw with a read-only mount. His preference for a dedicated observer comes from the value he experiences per interaction. His illustrative comparison is an agent saving thirty seconds on a weather check versus an observer revealing two weeks of avoiding his most important project. This is his assessment of usefulness, not a measured comparison between products.
He also sees less opportunity for exfiltration and less contamination of the observed record, although the security boundary needs closer examination. The product distinction stands independently: agents perform actions; observers help people notice and interpret patterns. Read-only need not be a capability users eventually graduate from. As he puts it, “A mirror isn't a broken butler.”
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
The useful combination is also a sensitive target
The same cross-referencing that makes the observer valuable creates its central privacy risk. The mosaic effect is what happens when many small pieces of information combine into a revealing picture. A fragment that seems modest in isolation may become sensitive when connected to other fragments. Podhajský’s own product description therefore doubles as a threat description: the combined view is an attractive target precisely because it reveals more than any single source. Read-only access protects the source record from modification; it does not make that combined picture confidential.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Read-only does not close the exfiltration path
Simon Willison’s lethal trifecta makes the remaining risk explicit: private data, untrusted content, and external communication coexist in one system. Podhajský initially thought read-only access broke that combination. He then recognized that removing source writes only removes some natural exfiltration channels. Shell access can still communicate externally, so the third capability remains.
Even in ordinary operation, this system sends data to Anthropic. Podhajský describes a mostly open network and more accessible information than the task strictly requires. He does not claim the system is secure or fireproof. His position is that he has examined its exposure and decided which risks he is willing to carry—a different posture from leaving them unrecognized.
That leaves a useful, bounded purpose for the system: turn an underused personal dataset into material for reflection. Your digital activity already records traces of attention, commitments, and relationships. Bringing those traces together can help you decide what to change, while leaving the decision and the action with you.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Resources
From the talk
Explains how private data, untrusted inputs, and external communication combine to enable data theft through prompt injection.
Explains automated permission decisions and how they differ from disabling permission checks.
David Allen's discussion of the Weekly Review, with eleven review steps and a checklist.
Further reading
The February 2026 announcement introducing Opus 4.6 and its one-million-token context window in beta.
Updates since the talk
Current documentation for extending Claude Code with reusable skills.
Current sandbox configuration guidance, including read-only workspace access and separate mount permissions.
Read the complete timestamped transcript
- 0:01
Hi, my name is Šimon. Today I'll talk about a personal AI system that knows you but won't do anything instead of you or on your behalf, and won't blow up your life.
- 0:13
So that's good. In the process, I'll talk about the risks of personal AI and how read-only AI systems like this one mitigate them.
- 0:21
Let's get started. The whole personal AI space is obsessed with agents that act on your behalf. I built something different.
- 0:30
The starting point, six sources, read access only, no write permissions. The limitation is fully intentional.
- 0:39
But first of all, what are cognitive exhaust fumes? What are they? It's my term for the digital activity that is a byproduct of your cognition, like exhaust fumes for a car engine.
- 0:50
Individually, it's just waste, but if you analyze the exhaust, you can diagnose the engine.
- 0:56
So let's see some examples of what the exhaust reveals.
- 1:00
What does this enable you to do? Three top uses I found: intention-action gaps, attention drift,
- 1:08
and relationship decay. No single source tells you any of this, and the cross-source ability is what these have in common. Your email client doesn't know what you journaled. Your task manager doesn't know what you're browsing.
- 1:23
The cross-source signal is the product. Let's take a closer look at the system.
- 1:29
Here it is, full in. Three zones. The sources are read-only. The AI never writes back to them. The workspace is where the analysis happens. The outputs land in a separate Obsidian vault for me to review, but it doesn't have to be a separate Obsidian vault.
- 1:45
It could be a separate Notion, separate text file, separate anything. Could be any other system. And that's the whole thing.
- 1:54
So what about applications? Let's start with a David Allen style Getting Things Done like spin on the weekly reflection. Based on the six sources, the AI synthesizes an occasionally brutal reflection on how you spent your week.
- 2:07
Let's look at a real example. Everything runs in Claude. I've stored this logic in the weekly reflection slash command slash skill. And what it does is it launches a Python script that gets all the data that come from the read-only sources and looks through them and creates structured outputs with
- 2:32
specified prompts that I've prepared. This takes a little bit of a while. It pings the Anthropic API to get those structured outputs back. And once it does, it will create a Markdown document that I will be able to review.
- 2:51
This is now all finished running, so it gives me an overview, and I can open it back up in Cursor and I'll convert it to a preview that's more readable and see that in fact, it does hit the themes of the week.
- 3:09
It does hit some of the tensions and conflicts that I need to think about.
- 3:14
Talks about my commitments and relationships, which is mostly notable by its omissions, and highlights the notable moments as well as reflection questions that I like to think about.
- 3:31
In short, this is not a productivity report. It's a reflection on how you're thinking, assembled entirely from exhaust.
- 3:38
Let's take another example. I like to discuss what I'm reading with others, but sometimes I think I shouldn't keep messaging the same three people about it. So I ask the AI, given my recent reading, who in my network should I be discussing this with?
- 3:53
This is the cross-source magic. Four data sources, none of which were designed to talk to each other, combined into an insight you'd never get from any single tool, and all read-only.
- 4:03
Nothing was sent, nothing was scheduled. Just a suggestion for me to act on if I choose.
- 4:10
Let me once again show you the demo.
- 4:14
Once again, this is a Claude skill, but in this case, I've hidden most of the pa- guts of the Claude skill into the cross-origin query and ask for the specific question, uh, in plain language.
- 4:30
The plain language knows that it will auto, uh, that it will activate the specific skill for the cross-source queries, and it now goes through the databases that I've curated, that I have regular ingest for, looks through the Vivaldi SQLite database for the articles that I've been reading the most.
- 4:52
And after a while, it will figure out which of these articles, um, are most read, still open on tabs, and which people might be curious about it based on the profile.
- 5:08
Now, this is probably the weakest part. The Clay MCP takes forever to run, but it searches my CRM or my friend relationship system, I suppose so, FRM, for people who might be interested in articles on, on these topics.
- 5:27
Um, in this case, it's people interested in AI or people in European tech or people in education, which coincidentally are three things that I also am.
- 5:42
Now, as you might notice, this takes up a lot of tokens in the context window, so you probably don't want to do this in a session that is not clean, but it's not a problem if it, uh, messes up a little bit of the one million context window for 4.6, and then you clear it again.
- 6:02
So at this point, it's getting the responses from all of the Clay searches. It synthesizes the people that I should talk to, and it maps them to one article each.
- 6:16
That's what the... Or it's about to map them to one article each. Uh, this requires a little bit of, uh,
- 6:25
bash sorcery on behalf of Claude Code, but if you run it with auto to auto mode or dangerous escape permissions, you can get rid of that as well.
- 6:34
And indeed, when I take a look at the first res- results, those look like the people that I might want to talk to that I haven't talked to yet about the kinds of articles that I've been reading.
- 6:46
So thank you, Claude. Right. In this case, it even found the author of the article that I was reading that's in my network, so I should give them a whirl.
- 7:13
In short, no source knows all of this. Your browser doesn't know your contacts. Your CRM doesn't know what you're reading. The exhaust does.
- 7:28
So why keep it read-only if it's so useful after all? Here's the thing about the risk involved. It's asymmetric. The downside of a read-only error is zero. I just ignore it.
- 7:39
The downside of a write error is unbounded, and personal AI operates in the highest stakes environment: your relationships, your career, your reputation.
- 7:51
I'd rather miss out on automated emails than have a misfire nuke my life.
- 7:57
But there's also a subtler philosophical argument, almost a matter of taste. Read-only isn't just safer, it produces better analysis. The moment your AI writes to your data sources, the exhaust fumes are contaminated.
- 8:10
You're no longer observing your cognition. You're observing a human AI hybrid, and you can't tell which patterns are yours. Sure, the observer changes your behavior too, but the feedback loop is mediated by you, not automated.
- 8:25
You read the reflection. You decide what to do. That's a different thing from the AI rewriting your draft. And there's an argument to be made that you don't want the AI to write your draft in the first place, that you should reclaim your agency.
- 8:39
That might be a hard sell for this crowd, I think, but worth considering.
- 8:44
At this point, you might be asking, why not throw all this into OpenClaw on a read-only mount? Which I have.
- 8:51
Here's the thing. The produce-- the observer produces more value per interaction by a wide margin. The agent saves me thirty seconds on a weather check. The observer shows me I've been avoiding my most important project for two weeks.
- 9:06
Not to mention that there's less risk of exfiltration and cognitive pollution.
- 9:13
The argument I'm making here is that read-only isn't a stepping stone to, quote unquote, real agents. It helps you do things well, yes, but it fits a different gap, serves a different need.
- 9:24
It's a different product category. The industry frames read-only as a limitation you graduate from. I think that's wrong. Observers and agents are different tools. A mirror isn't a broken butler.
- 9:40
So that's the value proposition. But I'd be doing you a disservice if I stopped here. Let's put on the paranoid hat.
- 9:50
What keeps me up at night? Let's start with the mosaic effect.
- 9:55
There's something called the mosaic effect, where you put together a lot of small pieces of information and you get a picture.
- 10:03
My own slide copy describes the security risk perfectly. The same cross-referencing that makes the system useful makes it a devastating target.
- 10:11
So careful there. The other side of the coin, Simon Willison's lethal trifecta. In case you don't know the lethal trifecta, it's a security risk model that combines three factors: private data, untrusted content, and external communications.
- 10:29
I initially thought read-only broke the lethal trifecta, and it doesn't, not fully. It removes the natural exfiltration cir-- uh, channels, but the third leg is any ability to communicate externally, and shell access still has that.
- 10:45
In short, the system isn't fireproof, and I'm not claiming that. Even in the best case scenario, I'm still sending data to Anthropic on a network that's mostly open with a lot more information lying around than is strictly speaking required.
- 11:00
I'm not claiming the system is secure. I'm claiming that I've thought about where it isn't, and I've decided which risks I'm willing to carry. It's different from not knowing.
- 11:09
The worst security posture is the one you haven't examined.
- 11:14
With that said, I still think there's something worthwhile to be learned from all this. Your digital exhaust is the most underused data set you own. Reflect on it and use it to make yourself better.
- 11:26
Thanks for listening.